Firefox update fixes 167 security holes, 41 found by OpenAI

Mozilla released Firefox 159 on Oct. 27, and it fixes 167 security flaws. OpenAI's tools and researchers found 41 of them. Mozilla rates 108 of the flaws high. None is rated critical, and Mozilla reports no active attacks. Still, it is a large batch, and the fix takes about a minute.

What changed

Of the 167 flaws, 108 are rated high, 52 moderate and 7 low. Most of the high-rated ones are use-after-free bugs. That means a program keeps using computer memory after it has let that memory go. In the worst case, an attacker can use such a bug to run malicious code on your device.

Mozilla credits OpenAI's Codex Security, an AI security agent OpenAI launched as a research preview in March, with 34 of the flaws. OpenAI researcher Amy Burnett reported 7 more. The only sandbox escape on the list, a bug that lets code break out of the browser's protective walls, was found by Mozilla itself.

Why the number is so big

Part of the jump comes from a change in how Mozilla counts. It used to bundle internally found memory bugs under one entry. Now each one gets its own. Counts from older Firefox releases are not directly comparable. Apple's latest list was also long: iOS 27.2 fixed 163 vulnerabilities.

AI has helped here before. In February, Anthropic pointed its Claude Opus 4.6 model at roughly 6,000 C++ files in Firefox. That led to 22 fixes, mostly shipped in Firefox 148. These tools are not perfect, though. In July, a root vulnerability was reported that Anthropic's AI had overlooked.

Who it affects

Anyone using Firefox on Windows, macOS, Linux or Android. Firefox normally updates itself, so many people may already have version 159. If your browser is set to update on its own and you restart it now and then, you are probably fine. Checking is still quick.

One group needs to act. Firefox 159 no longer supports Windows 8.1 and earlier, or macOS 10.14 and earlier. Mozilla tells people on those systems to switch to Firefox ESR, a version of the browser kept for longer-term use.

What to do

The steps in the alert box above walk through the check. The About Firefox window shows your version and downloads any pending update.

Other changes in this release

• Saved passwords now appear in the sidebar by default.
• Searching open tabs uses Ctrl+Shift+A on Windows and Linux, or Cmd+Shift+A on macOS.
• Smart Window, the AI window in Firefox, can watch pages for price drops or restocks.

The watch feature works by typing /watch in the chat. Firefox then sends a desktop notification when it finds a match. It is rolling out gradually and is currently available only in English in the US and Canada, and in French. Anyone who wants no AI in the browser can block it under AI controls in the settings.